Exetools

Exetools (https://forum.exetools.com/index.php)
-   Community Tools (https://forum.exetools.com/forumdisplay.php?f=47)
-   -   ScyllaHide (https://forum.exetools.com/showthread.php?t=15712)

sendersu 07-19-2021 17:32

I found this page to be very useful when porting old stuff into new v7.x

https://hex-rays.com/products/ida/support/ida74_idapython_no_bc695_porting_guide.shtml

niculaita 06-03-2023 00:17

How to bypass Debbuger setected (E0033) by Sentinel protection in xdbg 32/64 ?
schillahide profiles are not enough

sendersu 06-03-2023 03:45

"selected" or "detected" ? :)
2) pls share your sample so reversers will have a chance to dig into
otherwise you have to find the magic ball :)

deepzero 06-03-2023 04:31

literally any scylla profile works for me, e.g. vmp

niculaita 06-04-2023 01:09

I mean in windows under 10 22H2 x32 x64 with x32dbg.exe

sendersu 06-04-2023 16:14

Have you tried other debuggers like Ollydbg (YES! it still works in w10/11 in 32 bits)
or Ida Pro?

niculaita 06-04-2023 17:01

ollydbg special custom in win 7 32 yes
windows 10 32 and 11 x64 no success

from log
2023.06.04 11:52:56 INFO: Loaded VA for NtUserBlockInput = 0x76CE4AE0
2023.06.04 11:52:56 INFO: Loaded VA for NtUserQueryWindow = 0x76CE1160
2023.06.04 11:52:56 INFO: Loaded VA for NtUserGetForegroundWindow = 0x76CE13F0
2023.06.04 11:52:56 INFO: Loaded VA for NtUserBuildHwndList = 0x76CE1220
2023.06.04 11:52:56 INFO: Loaded VA for NtUserFindWindowEx = 0x76CE16F0
2023.06.04 11:52:56 INFO: Loaded VA for NtUserGetClassName = 0x76CE17C0
2023.06.04 11:52:56 INFO: Loaded VA for NtUserInternalGetWindowText = 0x76CE1650
2023.06.04 11:52:56 INFO: Loaded VA for NtUserGetThreadState = 0x76CE1080

can you sent folder of you debuger with cfg and ini files for plugin and other settings for x64/32dbg ?

sendersu 06-04-2023 19:40

Debugger detected (E0033) by Sentinel protection LDK
uses some custom-made detection, this is not a single checkbox (or even set of checkboxes) from S.Hide


All times are GMT +8. The time now is 06:55.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2024, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX